I want to run the 8 steps but cannot.
my browsers IE and firefox get redirected to my C drive.
I did run malwarebytes and that helped one time. Now I cannot run it.
Programs I am able to run.
AVG 8.5
crapcleaner

I cannot run malwarebytes, IOBit, spydoctor. I am told that files are missing or corrupt and I should reinstall, however when I try I am informed I'm missing files (I cannot include the error messages, at this time I am not at home)

I tried but cannot "Restore advanced settings" in IE. I click OK and it stalls.

My system cannot install "some" new apps.
I cannot access the internet via the browser, but I can ping the internet. I have a share connection to my other PC and that is the only reason I can access the antivirus/spyware programs you suggest.

I even ran or tried to run these programs from safe mode and still could not.

I was able to run hijackthis a couple of days ago, but I can no longer run malwarebytes.

Symptoms
1. very slow startup
2. I need to manually power down the PC
3. I do have trojan-backdoor-stinkbreath found by spysweeper but I could not clear it because I could not log into spysweeper via internet to pay for it.
4. Cannot run most antivirus, anti spyware programs.

I am unable to run the 8 steps. I might be able to run several.
I am at the point to save what I can from the hard drive and reinstall XP Pro, but I'd rather get the PC cleaned.

What I believe started this whole mess was
Antivirus Software Pro. (in my system tray)
I knew I didn't install this and found out this was virus/spyware. I used malwarebytes to remove it. However, there are other viruses/spyware that probably came with this and I can't find them.

You have a good approach to dealing with the issue yourself...
But I have never seen an infestation prevent SAFE MODE from running from a cold boot.
Running removal tools in SAFE MODE will probably be key to getting your system back to safe operation. You are also correct about Antivirus Software Pro being an evil.
Are you going to SAFE MODE from a cold boot?
You might consider switching from AVG 8.5 to Avira Antivir free or AVAST free antivirus, and also have SuperAntiSpyware and MalWareBytes.org (there is another irritating program that calls itself MalWareBytes and you do not want to use that... so look for the .org in your search.
Have all these handy for when you get it to boot properly... even install them while it is misbehaving...

Do you have access to another PC where you can load this drive as a Slave, and run the programs from the main drive?

Actually from the problem PC, I can access a shared folder on my good PC. That is where I load the anti-virus, anti-spyware programs and I can execute them, which installs them on the problem PC.

I also removed my restore points.

The only way I can access safe boot is by using msconfig, setting it up to safe boot and then shut down and start the PC. For some reason I do not have the safe boot option using F8 (or is it F1). But I do get into safe mode with a cold boot.

I also found information to remove files/registry entries manually. I may try that, but at first I will try running software that you recommend.

I did run hijackthis a couple of days ago. I am not an expert, but nothing caught my eye looking at the log. I am hoping to be able to run malwarebytes and hijackthis again with a log so I can submit it.

And yes, it is very strange that I am having problems running and installing in safe mode.

Attached Files:

"Do you know what this might be? Or to what it refers: " vbalsgrid6.ocx " You have some device or component on your system that is out of date or improperly installed which seems to be stopping the rest of the installation of test and removal tools.
Then you have AVG 8 installed, which is old an ineffective. I sugges you remove that using Add and Remove, then install AVG 8.5 if you must, or Avast free, or Avir Antivir free.
Then run a scan again.
If WebRoot Spyware is still up to date, it will be protecting you from most evils.

I was able to run some applications using another login. However, after I rebooted from running super anti-virus, I could no longer run applications, or transfer files to my good PC.
Attached are several files

I want to run the 8 steps but cannot.
my browsers IE and firefox get redirected to my C drive.
I did run malwarebytes and that helped one time. Now I cannot run it.
Programs I am able to run.
AVG 8.5
crapcleaner

I cannot run malwarebytes, IOBit, spydoctor. I am told that files are missing or corrupt and I should reinstall, however when I try I am informed I'm missing files (I cannot include the error messages, at this time I am not at home)

I tried but cannot "Restore advanced settings" in IE. I click OK and it stalls.

My system cannot install "some" new apps.
I cannot access the internet via the browser, but I can ping the internet. I have a share connection to my other PC and that is the only reason I can access the antivirus/spyware programs you suggest.

I even ran or tried to run these programs from safe mode and still could not.

I was able to run hijackthis a couple of days ago, but I can no longer run malwarebytes.

Symptoms
1. very slow startup
2. I need to manually power down the PC
3. I do have trojan-backdoor-stinkbreath found by spysweeper but I could not clear it because I could not log into spysweeper via internet to pay for it.
4. Cannot run most antivirus, anti spyware programs.

I am unable to run the 8 steps. I might be able to run several.
I am at the point to save what I can from the hard drive and reinstall XP Pro, but I'd rather get the PC cleaned.

Any ideas?
thanks

Click to expand...

Hi,
Donot worrry, follow the below mentioned steps

1. First you shoutdown the system.
2. start the system in safe mode by pressing F8 key in the boot mode.
3. backup all the data in C:\ to External storage device its better to write it to CD\DVD
4. If u can identify the path of the malware installed u try to delete it in command prompt. First you delete all the malware files inside the folder then in windows prompt you can delete the folder.

5. If you are not sure where the location is donot worry.
6. you have to restore the system restore option.
path -> START-PROGRAMS-ACCESSARIES- SYSTEM TOOLS - SYSTEM RESTORE
Here you will get the available restorable dates and click the date earlier to the infected date it will restore the data and u will be able to use safely your system.

I have not backed up the C drive yet, and my system restore files are gone because I stopped them in order to run an antivirus and antispyware. Some of the viruses gave locatations of being in the system restore.

***************************************************************************
I have more info.

ToDay 07-11-2009
Though I was able to install Avira antivirus, I was not able to retrieve the latest
definitions.

It found TR/Agent.21438.B (2 instances)
I have the log for this

***

When trying to open IE
At the bottom of my IE browser (when you see the page it is opening) I see this
C:\WINDOWS\system32\shdoclc.dll/dnserror.htm
I am researching how to fix the problem.

I can open my web browser by using a webpage I created, and executed from the good PC. However, I cannot access the internet with either browser.
I also uninstalled FireFox and reinstalled Firefox 3.5.

I ran IPCONFIG /flushdns
I also performed IPCONFIG /All and I do have DNS Servers

This gets stranger each day. I was able to drag and drop to folders and now I cannot. I was able to access another computer and move/copy files and cannot. I created a new folder under shared documents and this worked. However, if I truly still have a virus/spyware, it has to be an IA type. Because once a function works for me, once I restart or start from cold boot, it no longer does. ie. Start | Search no longer works. I am doing most of what I can through DOS.

I am transferring some files from the bad PC to the good one. Translated, I am transferring files from my Wife's computer to my computer. What ever site she accessed that caused her issue, could come up again on my machine. However, I do have super anti-spyware and Avira anti-virus running on my PC.

In the meantime, stop the xfr and use your wife's computer to burn a Knoppix CD, use it to boot up your computer. Then transfer all your files to a flash drive or external Disk. Something you can isolate until you can be sure the files aren't infected

txtexas, you are getting ALOT of help from all sorts of people. I would listen to just kritius and LookinAround on this one, as you will get confused and start running around in circles following each different instruction.

kritius is a known malware helper and LookinAround is an established hardware/software helper.

I am reviewing the various logs you have attached. Please do NOT try to do any other 'fixes' unless kritius comes back and picks up the thread.

I will be back as soon as I've had a chance to review the logs and the error you got on Malwarebytes.

But if you keep changing things around, it will be a waste of time for both of us.

Edit: I didn't mean to slight anyone here. But when multiple helper are sending you in different directions, it can get confusing.

I do notice signs of piracy though:C:\Documents and Settings\All Users\Documents\Downloads\Cracks\officeXP_Crack\Microsoft_Office_XP_Activation_All_Versions_and_Service_Packs.zip
[DETECTION] Is the TR/Agent.21438.B Trojan

:\Documents and Settings\All Users\Documents\Downloads\Cracks\officeXP_Crack\OfficeXP_Activator.exe
[DETECTION] Is the TR/Agent.21438.B Trojan

I might have said this earlier. This machine was purchased many years ago from someone in the neighborhood. That is one reason I could not try to fix the OS, if it had anything wrong. Because I had an XP CD from another machine and when I tried to install or check the OS on this, it told me my CD was older than the OS on the PC. AVIRA removed this anyway when I ran the antivirus.

So if I ever get this cleaned up, I believe I have 4-5 licenses within the XP OFFICE software I have. I didn't need to install it on this problem PC, because it already had it on.

Okay, I would like you to follow this as best you can-=without doing anything else to the troubled system!

First, you may have your computers networked, but you don't 'share' antivirus programs. You install the AV on each computer. This may be different in a large work environment on UNIX systems, but for home computers, you put the AV on each.

#5Actually from the problem PC, I can access a shared folder on my good PC. That is where I load the anti-virus, anti-spyware programs and I can execute them, which installs them on the problem PC.

Click to expand...

Is this something you've always done or something you're trying since you have malware? Are you using the other computer like a flash drive? Don't! If you can't access and download a program on the problem computer, load it on a flash drive and then install it on the problem computer.

#5For some reason I do not have the safe boot option using F8 (or is it F1). But I do get into safe mode with a cold boot.

Click to expand...

This is how you get into Safe Mode. Were you thinking you could just switch over to Safe Mode from Normal Mode?How To Boot into Safe Mode
[*] Restart your computer and start pressing the F8 key on your keyboard.
[*] Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

I did run hijackthis a couple of days ago. I am not an expert, but nothing caught my eye looking at the log.

Click to expand...

That's our job-so let us do it! Usually most of the entries are benign but we see those that are not.

AVG
Please open the AVG Control Center program -> double-click on the "AVG Resident Shield" component (looks like this: ) -> deselect the "Turn on AVG Resident Shield" checkmark and save the setting.
When you need to enable the AVG Resident Shield, ( I will let you know when) just open the AVG Control Center program -> double-click on the "AVG Resident Shield" component -> select the "Turn on AVG Resident Shield" checkmark and save the setting.

Please reopen HijackThis to 'do system scan only.'CHECK the following entries if present:

Go to Start> Run> type in msconfig> enter> Selective Startup> Startup tab> UNCHECK the following if present:
AVG guard v7.5> this is no longer supported. It is included in v8
All Advanced System Care entries (allowing this to be changing the system while cleaning should not be allowed to start up.
Any entries for Antivirus System PRO
When through> Apply> OK

Control Panel> Add/Remove Programs> UNINSTALL any entry for Antivirus System Pro.

Reboot the computer into Normal Mode. NOTE: Ignore the nag message and close it after checking 'don't show this message again.' Stay in Selective Startup.

Reset Cookies This will prevent the pages and pages of Tracking Cookies that you have gotten.

For Firefox: Tools> Options> Privacy> Cookies> CHECK ‘accept Cookies from Sites’> UNCHECK 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others.

Bobby,
I will attempt to do some of this.
Let me tell you a little more about this 'problem PC'
For some reason when I try F8, I get the boot up menu and safe mode is not an option. It is on my other systems. That is why I have to perform Start | Run | MSConfig and change the boot.ini to be safe mode.

I did not normally use my good pc as a flash drive. Sometimes I would copy files over this way from PC to PC. The Problem PC would not install AVIRA, something about a windows installer problem.

I have 4 USB ports on this machine and the odd thing now is that the only one that works is the one I have my mouse connected to. I connected a 4 port USB to the working port, but then no port on the 4 usb ports will work.

The AVG 7.5 - is already gone. I could not find it in the add/remove of the control panel, so I searched everywhere in the registry for it and removed it.

I haven't had the machine on since (I think) Sunday.

I just tried F1 on boot up and it was not the boot menu. During POST I did see F8 as the boot menu, but I know safe mode doesn't exist

As I mentioned in a previous post, I purchased this computer years ago from a neighbor. If I had pirated MS Office on it, maybe I have some kind of OEM OS on it that is not a full version of XP PRO.

I am going to print out the instructions you provided for me (which I really appreciate the time you spent to do this). I will check later tomorrow in case you posted a reply to the additional information I have provided.

Since I cannot use F8 into Safe Mode, will changing to safe mode within msconfig work as a work around for the instructions you provided?
thanks